Phishing Fishing or Phishing? Definition Phishing: an attempt to - - PowerPoint PPT Presentation

Phishing

Fishing or Phishing?

Definition

• Phishing: an attempt to trick victims into

sharing sensitive information such as passwords, usernames, and credit card details for malicious reasons.

• Phishing can be in the form of emails, social

media messages, texts, or phone calls.

• General phishing attempts are sent to a large

amount of people at the same time with the hope that someone will click on on a link and provide their personal information.

Definition

• Spear-phishing: An attempt to trick a

specific victim into sharing sensitive information.

• Often appear to be from a legitimate sender
• r someone familiar to the victim
• Messages are modified to specifically

address a victim

• Includes personal information about the

victim, usually obtained from social media

Features of a Phishing Attack

• Asks you to verify or update account

information, such as name, date of birth, mothers maiden name, security questions, credit card information, and password.

• The tone gives a sense of urgency or

that you're in trouble. You have a limited time to respond.

• There are spelling and grammar errors.

Features of a Phishing Attack

• What they’re saying sounds too good

to be true.

• The greeting or closing is generic.

The greeting might say “Dear Valued Customer”

• Links or attachments that lead you to

a login page or a online form where you will have to provide personal information.

Examples of Phishing Attacks

Due to a sytem error, you were double charged for your last Amazon

• rder. A refund was initiated, but could not be completed due to an

error in your billing address. After your address has been updated and validated, you should receive your refund within 3 business days. You are required to update your valid address within 24 hours to receive your refund. Click her to update your DATA. Sincerely, amazon.com Spelling/grammar error Sense of urgency

Link that leads you to another page to enter personal information. Asking to verify or update information Generic closing

Sense of urgency

Link that leads you to another page to enter personal information. Asking to verify or update information

You have been sent this invitation because our records indicate you are currently a user whose account has not been activated. We are therefore sending you this email so that you can inform us whether you still want to use this account. If you are still interested in having this account, please update your DATA immediately because out system requires an account verification for the update. Click here to verify your account.

DATA

As part of our security measures, we regularly update all acounts on our database system. We are unable to update your email account and therefore will be cooling your email account to enable the web upgrade. Dear Gmail User, Sincerely, Gmail Member Services Team We appreciate your cooperation in this matter. Warning! Any account owner that refuses to update their account after receiving this email will lose their account permanently. To prevent an interruption with your Gmail services, please take a few moments to update your account by filling out the verification and update form immediately.

Spelling/grammar error Generic greeting Generic closing

Sense of urgency

Link that leads you to another page to enter personal information. Asking to verify or update information

Sense of urgency

Link that leads you to another page to enter personal information. To good to be true

Other Phishing Resources

• Video: Phishing Scams in Plain

English

• Scams and Schemes - Common

Sense Education

• Better Business Bureau Scam Tips
• Game: Phishing Scams - Avoid

the Bait

URL Analysis

URL Analysis

• Most email or text message

phishing attacks start with a specially-crafted URL.

• Even if an email or text doesn’t

have any of the phishing features, you can still get hooked!

URL Analysis

• Which URL do you think is the real

Facebook URL?

• https://www.accounts.facebook.com/

verifylogin/user/

• https://www.facebook.fblogin.com/home

• If you read the URL #2 from left to right, like

English, then this URL appears legitimate.

• This is the wrong way to read a URL.

URL Analysis

• The right way to read a URL is right to left.
• FIRST, start on the right of the URL and

locate the Top Level Domain (.com)

• The Domain name after the Top Level

Domain is the registered user of the website.

• https://www.accounts.facebook.com/

verifylogin/user/

• https://www.facebook.fblogin.com/home

Analyze Phishy URL’s

• http://bankofthevvest.com
• https://getsupport.apple.com/?caller=home&PRKEYS=
• http://snapchat.verification.com
• http://instagram.privacy-information.socialapp.com

Bad URL Bad URL Bad URL Good URL

One More Example

One More Example